CBOM · GRC · ROC Platform

Break clock

Assets grouped by the year their algorithm stops being acceptable

Click a cohort to filter the register

Dedup note. 6 assets in this view are the same key material observed on more than one surface (KMS key, ACM certificate, Terraform resource). They are counted once, against the config-plane observation, and the corroborating surfaces are listed in the asset detail.

Violations by policy

Evaluated against the Meridian cryptographic algorithm standard, v4.1

Where it lives

Open violations by discovery surface

Policy	Rule	Severity	Open	Aged > 90d	Owner	Target close

Live exceptions

Covering 412 assets

Expiring in 60 days

Both require CISO re-approval

Expired, still in force

Escalated to risk committee

Ref	Scope	Deviation	Compensating control	Approver	Expires	Status

Instrument	Obligation this register serves	Evidence produced	Status

No Indian regulator names "CBOM" yet. The register is positioned against existing obligations — certificate inventory, SBOM encryption fields, cryptographic controls — and against the NIST transition dates, which are the hard external deadlines. US EO 14412 is cited as direction of travel only.

Every algorithm, key andcertificate in the estate.

Break clock

Violations by policy

Where it lives

Every algorithm, key and
certificate in the estate.